Fannie Mae 2004 Annual Report Download - page 208

governing information technology security and access. Furthermore, we did not maintain effective logging
and monitoring of servers and databases to ensure that access was both appropriate and authorized.
•Change Management
We did not maintain effective controls designed to ensure that information technology program and data
changes were authorized and that the program and data changes were adequately tested for accuracy and
appropriate implementation.
•End User Computing
We did not maintain effective controls over end user computing (“EUC”) applications, such as
spreadsheets. Specifically, controls were not designed and in operation to ensure that access to these
applications was restricted to appropriate personnel and that changes to data or formulas were authorized.
Independent Model Review Process
We identified a material weakness as of December 31, 2004 related to the design of our internal control over
financial reporting related to our independent model review process. Specifically, we did not independently
review that: (i) the models and assumptions used to produce our financial statements were appropriate; and
(ii) that outputs used to produce our financial statements were calculated accurately according to the model
specifications. Our loan loss allowance, amortization, guaranty and financial instrument valuation processes
each used models and, as discussed in “Item 7—MD&A—Restatement,” we incorrectly valued our derivatives,
mortgage loan and security commitments, security investments, guaranties and other instruments.
Treasury and Trading Operations
We identified a material weakness as of December 31, 2004 related to the design of our internal control over
financial reporting related to our treasury and trading operations. Specifically, our internal control over
financial reporting was inadequate with respect to the process of authorizing, approving, validating and settling
trades, including inadequate segregation of duties among trading, settlement and valuation activities within
both our treasury and trading operations.
Pricing and Independent Price Verification Processes
We identified a material weakness as of December 31, 2004 related to the design of our internal control over
financial reporting related to our pricing and independent price verification processes. Specifically, our internal
control over financial reporting was inadequate with respect to the process used to price assets and liabilities,
and did not maintain appropriate segregation of duties between the pricing function and the function
responsible for independently verifying such prices.
Wire Transfer Controls
We identified a material weakness as of December 31, 2004 related to the design of our internal control over
financial reporting related to our wire transfer function. Specifically, the design of our internal control over
financial reporting was insufficient with respect to the initiation, authorization, segregation of duties and anti-
fraud measures related to wire transfer transactions and with respect to the reconciliation of cash balances and
wire transfer activity. In addition, approvals were not consistent with approval policies and funds movements
lacked verifications.
Report of Independent Registered Public Accounting Firm
In January 2005, we engaged Deloitte & Touche LLP (the independent registered public accounting firm that
audited the consolidated financial statements included in this Annual Report on Form 10-K for the year ended
December 31, 2004) to audit management’s assessment of the effectiveness of our internal control over
financial reporting as of December 31, 2004. Deloitte & Touche’s report disclaimed an opinion on
management’s assessment of the effectiveness of our internal control over financial reporting as of
December 31, 2004 because:
• we did not engage Deloitte & Touche until after December 31, 2004;
203